refactor(workflows): validate multiarch images once#23
Merged
Conversation
- run low-memory HStore compose before image publication - import the bundled example graph and verify Gremlin CRUD - enforce runtime resource limits and strict cleanup checks - document CI scope and the future 3x3 topology TODO
dosubot
Bot
added
size:S
Walkthrough新增 Changes镜像发布流水线
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant build_test_publish_amd64
participant local_compose
participant publish_arm64
participant publish_manifest
Workflow->>build_test_publish_amd64: 构建并验证 AMD64 候选镜像
build_test_publish_amd64->>local_compose: 执行集成检查与 smoke test
build_test_publish_amd64->>publish_arm64: 成功后允许 ARM64 构建
publish_arm64->>publish_manifest: 提供 ARM64 镜像
publish_manifest->>publish_manifest: 创建并检查多架构 manifest
publish_manifest->>publish_manifest: 删除 AMD64/ARM64 临时标签
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the README.md documentation to detail the strict integration precheck for PD, Store, and HStore Server images. It explains the low-memory test profile constraints, the functional graph check using the bundled example.groovy file, and the Gremlin CRUD validation. It also documents that the precheck uses a 1 PD + 1 Store + 1 Server topology to fit standard GitHub-hosted runners. There are no review comments, so we have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a stricter pd/store/server integration precheck to the reusable publish workflow, aimed at validating a low-resource Docker Compose topology and exercising a bundled example graph + Gremlin CRUD before any publish steps run.
Changes:
- Adds compose-file auto-detection (
docker-compose.dev.ymlwith legacy fallback) plus CI override constraints (CPU/memory/JVM tuning) for PD/Store/Server. - Imports the Server image’s bundled
example.groovygraph and validates Gremlin read/create/update/delete, ensuring the graph returns to the baseline. - Improves failure diagnostics and enforces compose resource cleanup, and documents the new precheck scope in
README.md.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| README.md | Documents the new low-memory integration precheck, example graph import, and Gremlin CRUD validation scope. |
| .github/workflows/_publish_pd_store_server_reusable.yml | Implements the compose-based precheck (resource limits, example import, CRUD checks) plus enhanced diagnostics and cleanup enforcement. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+539
to
+550
| docker compose -p hg-ci-precheck -f "$COMPOSE_FILE" -f /tmp/docker-compose.ci.override.yml ps || true | ||
| docker stats --no-stream hg-pd hg-store hg-server || true | ||
| for container in hg-pd hg-store hg-server; do | ||
| docker inspect --format '{{json .State.Health}}' "$container" || true | ||
| done | ||
| for artifact in /tmp/hg-ci-example-import.log /tmp/hg-ci-gremlin-*.json; do | ||
| if [ -f "$artifact" ]; then | ||
| echo "===== ${artifact} =====" | ||
| cat "$artifact" | ||
| fi | ||
| done | ||
| docker compose -p hg-ci-precheck -f "$COMPOSE_FILE" -f /tmp/docker-compose.ci.override.yml logs --no-color --tail=200 || true |
Comment on lines
555
to
560
| set -euo pipefail | ||
|
|
||
| docker compose \ | ||
| -p hg-ci-precheck \ | ||
| -f docker/docker-compose.yml \ | ||
| -f "$COMPOSE_FILE" \ | ||
| -f /tmp/docker-compose.ci.override.yml \ |
- avoid unbound COMPOSE_FILE in failure paths - skip compose commands when setup never completed - preserve strict leftover resource checks
- build and validate amd64 candidates once before pushing - move arm64 builds to native GitHub runners without QEMU - add a non-publishing exact-master dry-run path - document cache isolation and Dockerfile follow-up
dosubot
Bot
added
size:M
- use cached x86 build stages when Dockerfiles pin BUILDPLATFORM - fall back to native ARM for legacy release Dockerfiles - isolate native ARM caches and keep dry-runs read-only - document measured QEMU and native runner tradeoffs
imbajin
changed the title
- decouple release source branch from image version tag - combine arm64 builds into one reusable runner job - combine manifest creation and temporary tag cleanup - keep amd64 integration validation ahead of publishing
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/_publish_pd_store_server_reusable.yml (1)
675-680: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win建议显式设置
persist-credentials: false。zizmor 提示该
actions/checkout步骤未设置persist-credentials: false，存在凭证持久化风险（artipacked）。该步骤 checkout 的是外部REPOSITORY_URL/SOURCE_SHA，后续构建步骤并不需要 git 认证能力，建议显式关闭凭证持久化以降低意外泄露风险。🔒 建议修复
- name: Checkout source uses: actions/checkout@v7 with: repository: ${{ env.REPOSITORY_URL }} ref: ${{ env.SOURCE_SHA }} fetch-depth: 2 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/_publish_pd_store_server_reusable.yml around lines 675 - 680, Update the “Checkout source” step using actions/checkout@v7 to explicitly set persist-credentials to false, while preserving the existing repository, ref, and fetch-depth settings.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/_publish_pd_store_server_reusable.yml:
- Around line 785-820: Update the input validation in delete_tag_with_retry to
detect a missing slash from the original image_repo format rather than comparing
namespace and repository values. Preserve valid repositories where namespace and
repository are identical, including hugegraph/hugegraph, so the function
proceeds with deletion attempts.
---
Nitpick comments:
In @.github/workflows/_publish_pd_store_server_reusable.yml:
- Around line 675-680: Update the “Checkout source” step using
actions/checkout@v7 to explicitly set persist-credentials to false, while
preserving the existing repository, ref, and fetch-depth settings.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: be1af3b3-6fe0-4645-a087-b80b903ab0e3
📒 Files selected for processing (3)
.github/workflows/_publish_pd_store_server_reusable.yml.github/workflows/publish_release_pd_store_server_image.ymlREADME.md
🚧 Files skipped from review as they are similar to previous changes (1)
- README.md
- load amd64 and arm64 candidates into the containerd image store - run integration checks against final local image tags - push validated multi-platform indexes without temporary tags - document the simplified publication and release inputs
- disable persisted credentials for external source checkout - keep source builds read-only after checkout - address the remaining applicable PR security comment
- prevent dry runs from updating the latest source hash - retry final multi-platform image pushes on transient failures - require local standalone images and remove dead matrix output - align release documentation with branch-only source resolution
- consolidate multi-platform builds behind one helper - retry transient QEMU runtime-stage failures per module - reuse completed BuildKit layers between attempts - preserve local multi-platform loading and cache policy
imbajin
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
address part of #7
scripts/example.groovy, assert 6V/6E, execute Gremlin CRUD, and restore 6V/6Ebranchfrom explicitversion_tag, somastercan publish1.7.0A/B result
All comparisons used
apache/hugegraph@master, strict integration checks, read-only registry caches, anddry_run=true.B is retained. Its observed runtime is in the same range as A (normal QEMU/network variance is larger than the difference), while it removes the separate ARM/manifest orchestration, eight temporary tags, and Docker Hub delete API. It also tests the final local tags directly.
A later run exposed the actual remaining ARM risk: QEMU segfaulted in the ARM
libc-binpost-install script. The final workflow retries only that failed module with completed BuildKit layers retained; permanent failures still stop after three attempts. The final successful run needed no retry.Verification
actionlintfor reusable/latest/release workflowsgit diff --check89b648a7f9a7f6c8d202bb199d3c2442d8d511f9scripts/example.groovy: 6V/6ESummary by CodeRabbit
新功能
改进